The former corresponds to the current behavior, where the module checks
that the supplicant is a member of the required group. The latter
checks the target user instead. If neither option was specified,
pam_group(8) assumes "ruser" and issues a warning.